2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--553ead98-1fb4-4ee6-a8ea-ad6d950d210b" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:39.000Z" ,
"modified" : "2015-11-13T21:19:39.000Z" ,
"name" : "CthulhuSPRL.be" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--553ead98-1fb4-4ee6-a8ea-ad6d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:39.000Z" ,
"modified" : "2015-11-13T21:19:39.000Z" ,
"name" : "OSINT Enterprises Hit by BARTALEX Macro Malware in Recent Spam Outbreak by Trend Micro" ,
"published" : "2015-11-13T21:24:19Z" ,
"object_refs" : [
"observed-data--553eade5-793c-4a21-bc6e-069f950d210b" ,
"url--553eade5-793c-4a21-bc6e-069f950d210b" ,
"x-misp-attribute--553eaded-4b28-4e7d-9de9-7df5950d210b" ,
"x-misp-attribute--553eae0e-b2a0-4f0c-a87f-ad6d950d210b" ,
"indicator--553eae22-047c-47ae-ad12-7df5950d210b" ,
"indicator--553eae23-93d4-4d15-bac4-7df5950d210b" ,
"indicator--553eae23-dd90-4b93-9027-7df5950d210b" ,
"indicator--553eae4f-f320-4b97-a4c7-7df5950d210b" ,
"indicator--553eae67-20b8-4592-b5ef-7dfa950d210b" ,
"indicator--553eae67-e224-4269-89c7-7dfa950d210b" ,
"indicator--553eae67-580c-405e-92ed-7dfa950d210b" ,
"indicator--553eae67-bdac-494c-9833-7dfa950d210b" ,
"indicator--553eae67-45d4-45e3-8497-7dfa950d210b" ,
"indicator--553eae68-74cc-4173-986d-7dfa950d210b" ,
"indicator--553eae68-5274-4783-afb2-7dfa950d210b" ,
"indicator--553eae68-51b8-4346-afba-7dfa950d210b" ,
"indicator--553eae68-ce6c-4cf8-892d-7dfa950d210b" ,
"indicator--553eae68-1e20-4ee6-a27e-7dfa950d210b" ,
"indicator--55466137-aa1c-41b4-817d-4ad5950d210b" ,
"indicator--55466138-42d4-49fe-a270-4d53950d210b" ,
"indicator--55466138-d72c-41d7-9b87-4d42950d210b" ,
"indicator--55466138-f89c-43a3-99d6-43dd950d210b" ,
"indicator--55466138-b32c-4fae-a112-456f950d210b" ,
"indicator--55466138-3b68-4f43-a2a1-4e8c950d210b" ,
"indicator--55466138-a018-49e4-8ccb-40f4950d210b" ,
"indicator--55466138-a6e4-413b-afc3-4a75950d210b" ,
"indicator--55466138-7fe0-48a2-8eeb-4f55950d210b" ,
"indicator--55466139-e940-4f03-9311-4904950d210b" ,
"indicator--55466139-e27c-4680-b590-43b4950d210b" ,
"indicator--55466139-7880-481e-9460-4dcf950d210b" ,
"indicator--55466139-7de4-41b6-b690-4259950d210b" ,
"indicator--55466139-bde4-4863-82cf-49f4950d210b" ,
"indicator--55466139-6eac-4bf2-b24a-4bba950d210b" ,
"indicator--55466139-5148-4b4e-a64b-4815950d210b" ,
"indicator--55466139-8ae4-4702-adcc-468a950d210b" ,
"indicator--5546613a-65b8-4b22-bbb4-4f58950d210b" ,
"indicator--5546613a-f670-4fac-91f6-4a21950d210b" ,
"indicator--5546613a-2780-4cca-a850-48d2950d210b" ,
"indicator--5546615c-f99c-4629-b4cd-4483950d210b" ,
"indicator--5546615d-96e0-45d6-9dcd-4ada950d210b" ,
"indicator--5546615d-3608-4a5a-8cea-47b8950d210b" ,
"x-misp-attribute--5546619a-8b20-4c44-819b-4b94950d210b" ,
"indicator--564653eb-6c0c-46ae-bd9e-48b6950d210b" ,
"indicator--564653eb-a23c-472c-ba92-4cfe950d210b" ,
"observed-data--564653ec-e944-4759-9825-41a5950d210b" ,
"url--564653ec-e944-4759-9825-41a5950d210b" ,
"indicator--564653ec-e414-4f2b-af71-49ac950d210b" ,
"indicator--564653ed-3afc-4fc5-8a56-416a950d210b" ,
"observed-data--564653ed-1c88-4a60-a1f3-4918950d210b" ,
"url--564653ed-1c88-4a60-a1f3-4918950d210b" ,
"indicator--564653ee-aa3c-49b2-96d7-4df5950d210b" ,
"indicator--564653ee-d81c-49f4-9f33-4a2e950d210b" ,
"observed-data--564653ef-fc04-407f-bcf9-4343950d210b" ,
"url--564653ef-fc04-407f-bcf9-4343950d210b" ,
"indicator--564653ef-3464-497e-a5b6-4828950d210b" ,
"indicator--564653ef-24b0-465e-aa3c-41e7950d210b" ,
"observed-data--564653f0-d6ac-4dd8-b0f5-42c2950d210b" ,
"url--564653f0-d6ac-4dd8-b0f5-42c2950d210b" ,
"indicator--564653f0-6b44-455e-85a3-4cd0950d210b" ,
"indicator--564653f1-a040-41ce-8946-49e5950d210b" ,
"observed-data--564653f1-e77c-439d-9622-410f950d210b" ,
"url--564653f1-e77c-439d-9622-410f950d210b" ,
"indicator--564653f1-7694-4f52-aff0-4dba950d210b" ,
"indicator--564653f2-ab38-4009-a63d-4c07950d210b" ,
"observed-data--564653f2-d5c8-4922-bc41-4c1e950d210b" ,
"url--564653f2-d5c8-4922-bc41-4c1e950d210b" ,
"indicator--564653f2-2c58-4ef4-98f6-4a39950d210b" ,
"indicator--564653f3-d0e0-4bd0-958e-4233950d210b" ,
"observed-data--564653f3-8650-4f8c-b4d1-477b950d210b" ,
"url--564653f3-8650-4f8c-b4d1-477b950d210b" ,
"indicator--564653f4-29dc-43b0-9334-4839950d210b" ,
"indicator--564653f4-d934-482c-a980-4a6e950d210b" ,
"observed-data--564653f4-a240-4e68-adb5-4221950d210b" ,
"url--564653f4-a240-4e68-adb5-4221950d210b" ,
"indicator--564653f5-4fd8-4e0e-9fbd-4607950d210b" ,
"indicator--564653f5-db4c-4003-a928-488b950d210b" ,
"observed-data--564653f6-f07c-46d1-a618-4248950d210b" ,
"url--564653f6-f07c-46d1-a618-4248950d210b" ,
"indicator--564653f6-4b1c-403a-a2d9-4610950d210b" ,
"indicator--564653f6-a338-4490-92bc-47e7950d210b" ,
"observed-data--564653f7-298c-4c97-806b-4d9b950d210b" ,
"url--564653f7-298c-4c97-806b-4d9b950d210b" ,
"indicator--564653f7-1ea8-4c79-af8f-4331950d210b" ,
"indicator--564653f8-e2bc-440c-a599-45db950d210b" ,
"observed-data--564653f8-ef50-488d-bc19-4be1950d210b" ,
"url--564653f8-ef50-488d-bc19-4be1950d210b" ,
"indicator--564653f8-5f9c-453e-a967-4dba950d210b" ,
"indicator--564653f9-ba60-4773-a625-48e7950d210b" ,
"observed-data--564653f9-66c0-4633-b4b5-4bec950d210b" ,
"url--564653f9-66c0-4633-b4b5-4bec950d210b" ,
"indicator--564653fa-3c30-4d50-bdfd-449b950d210b" ,
"indicator--564653fa-dbbc-4c0f-bf03-4c8e950d210b" ,
"observed-data--564653fa-56d8-4689-a5d3-465d950d210b" ,
"url--564653fa-56d8-4689-a5d3-465d950d210b" ,
"indicator--564653fb-7dd8-451e-a86f-49e3950d210b" ,
"indicator--564653fb-e2f8-4fc2-9393-4435950d210b" ,
"observed-data--564653fc-f88c-474c-8131-47e8950d210b" ,
"url--564653fc-f88c-474c-8131-47e8950d210b" ,
"indicator--564653fc-b6ac-4956-adf3-4087950d210b" ,
"indicator--564653fc-6b28-4e08-a03d-4df4950d210b" ,
"observed-data--564653fd-4b88-427b-a592-4a9d950d210b" ,
"url--564653fd-4b88-427b-a592-4a9d950d210b" ,
"indicator--564653fd-d208-4dc4-bbb5-4c0f950d210b" ,
"indicator--564653fe-1c5c-43a8-812d-41ae950d210b" ,
"observed-data--564653fe-1cb4-4208-abe1-4e7d950d210b" ,
"url--564653fe-1cb4-4208-abe1-4e7d950d210b" ,
"indicator--564653fe-1a18-48c1-a0e2-45de950d210b" ,
"indicator--564653ff-5ebc-4304-b1db-4ba3950d210b" ,
"observed-data--564653ff-8738-42bd-9f6a-4763950d210b" ,
"url--564653ff-8738-42bd-9f6a-4763950d210b" ,
"indicator--56465400-6bf8-4ad5-9239-4ea3950d210b" ,
"indicator--56465400-44d0-4f4c-a739-4fc7950d210b" ,
"observed-data--56465400-6c14-4580-9f6a-4445950d210b" ,
"url--56465400-6c14-4580-9f6a-4445950d210b" ,
"indicator--56465401-6a40-413e-b65e-4df0950d210b" ,
"indicator--56465401-cc6c-4e48-833a-44b0950d210b" ,
"observed-data--56465402-e55c-4de8-b766-47da950d210b" ,
"url--56465402-e55c-4de8-b766-47da950d210b"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT"
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--553eade5-793c-4a21-bc6e-069f950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:45:09.000Z" ,
"modified" : "2015-04-27T21:45:09.000Z" ,
"first_observed" : "2015-04-27T21:45:09Z" ,
"last_observed" : "2015-04-27T21:45:09Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--553eade5-793c-4a21-bc6e-069f950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--553eade5-793c-4a21-bc6e-069f950d210b" ,
"value" : "http://blog.trendmicro.com/trendlabs-security-intelligence/enterprises-hit-by-bartalex-macro-malware-in-recent-spam-outbreak/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--553eaded-4b28-4e7d-9de9-7df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:45:17.000Z" ,
"modified" : "2015-04-27T21:45:17.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Bartalex"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--553eae0e-b2a0-4f0c-a87f-ad6d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:45:50.000Z" ,
"modified" : "2015-04-27T21:45:50.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_type" : "text" ,
"x_misp_value" : "W2KM_BARTALEX.SMA"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae22-047c-47ae-ad12-7df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:46:36.000Z" ,
"modified" : "2015-04-27T21:46:36.000Z" ,
"description" : "W2KM_BARTALEX.SMA" ,
"pattern" : "[file:hashes.SHA1 = '61a7cc6ed45657fa1330e922aea33254b189ef61']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:46:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae23-93d4-4d15-bac4-7df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:46:36.000Z" ,
"modified" : "2015-04-27T21:46:36.000Z" ,
"description" : "W2KM_BARTALEX.SMA" ,
"pattern" : "[file:hashes.SHA1 = '6f252485dee0b854f72cc8b64601f6f19d01c02c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:46:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae23-dd90-4b93-9027-7df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:46:36.000Z" ,
"modified" : "2015-04-27T21:46:36.000Z" ,
"description" : "W2KM_BARTALEX.SMA" ,
"pattern" : "[file:hashes.SHA1 = '85e10382b06801770a4477505ed5d8c75fb37135']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:46:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae4f-f320-4b97-a4c7-7df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:46:55.000Z" ,
"modified" : "2015-04-27T21:46:55.000Z" ,
"description" : "TSPY_DYRE.YUYCC" ,
"pattern" : "[file:hashes.SHA1 = '5e392950fa295a98219e1fc9cce7a7048792845e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:46:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae67-20b8-4592-b5ef-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:19.000Z" ,
"modified" : "2015-04-27T21:47:19.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '0163fbb29c18e3d358ec5d5a5e4eb3c93f19a961']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae67-e224-4269-89c7-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:19.000Z" ,
"modified" : "2015-04-27T21:47:19.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '02358bcc501793454a6613f96e8f8210b2a27b88']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae67-580c-405e-92ed-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:19.000Z" ,
"modified" : "2015-04-27T21:47:19.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '05fe7c71ae5d902bb9ef4d4e43e3ddd1e45f6d0c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae67-bdac-494c-9833-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:19.000Z" ,
"modified" : "2015-04-27T21:47:19.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '11d6e9bf38553900939ea100be70be95d094248b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae67-45d4-45e3-8497-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:19.000Z" ,
"modified" : "2015-04-27T21:47:19.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '19aed57e1d211764618adc2399296d8b01d04d19']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae68-74cc-4173-986d-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:20.000Z" ,
"modified" : "2015-04-27T21:47:20.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = '559a03a549acc497b8ec57790969bd980d7190f4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae68-5274-4783-afb2-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:20.000Z" ,
"modified" : "2015-04-27T21:47:20.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = 'c0ca5686219e336171016a8c73b81be856e47bbc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae68-51b8-4346-afba-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:20.000Z" ,
"modified" : "2015-04-27T21:47:20.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = 'd047decf0179a79fd4de03f0d154f4a2f9d18da4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae68-ce6c-4cf8-892d-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:20.000Z" ,
"modified" : "2015-04-27T21:47:20.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = 'd3bf440f3c4e63b9c7165c1295c11f71f60b5f8c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--553eae68-1e20-4ee6-a27e-7dfa950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-04-27T21:47:20.000Z" ,
"modified" : "2015-04-27T21:47:20.000Z" ,
"description" : "Malicious .doc file" ,
"pattern" : "[file:hashes.SHA1 = 'ec7a2e7c1dce4a37da99a8f20a5d4674f5c80a1f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-04-27T21:47:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466137-aa1c-41b4-817d-4ad5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:07.000Z" ,
"modified" : "2015-05-03T17:56:07.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '037cebf49a412bcabd7d3b896382af53eaecabed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-42d4-49fe-a270-4d53950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '0b4100e124507a174f147c3bf0121769ab209104']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-d72c-41d7-9b87-4d42950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '0fad05ba34d91de15047052c4a6166d92aa5e3ac']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-f89c-43a3-99d6-43dd950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '1363b79fc25467ea01842c5cbfa90c90bd7e7790']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-b32c-4fae-a112-456f950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '164929155ab6f78a3ff46753b0a321e8dbd13e8a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-3b68-4f43-a2a1-4e8c950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '18df8417fce6f9e24c8369a2897eaf29b1ec11c4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-a018-49e4-8ccb-40f4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '21bc3485810e258b425e4b38e46d944f7be81c50']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-a6e4-413b-afc3-4a75950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '23f9777f17f86c9c8cbf25672e2e783ab0acc58c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466138-7fe0-48a2-8eeb-4f55950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:08.000Z" ,
"modified" : "2015-05-03T17:56:08.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '25cbbcc94782b2f1efd46179f28c517af44637fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-e940-4f03-9311-4904950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '29e4f4013c07dfcb0aae20c806b157ed7f023e9c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-e27c-4680-b590-43b4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '2b01eb798d31d91cc03221b82c3f3fe04f4eb40a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-7880-481e-9460-4dcf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '2b8c9af6d0c372f3343ae76e26d48f8c9eed37c7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-7de4-41b6-b690-4259950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '31dcc204661eee13920fda7ec582aaa1ec48f821']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-bde4-4863-82cf-49f4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '31e2a2152a974f69e98c235c0dd3cddc1984b8da']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-6eac-4bf2-b24a-4bba950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '3338db3553bc2ef8b7587f5b331c2a3ecbbbcd6c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-5148-4b4e-a64b-4815950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '339543194c2e64c27d746572d235dba37a332eeb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--55466139-8ae4-4702-adcc-468a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:09.000Z" ,
"modified" : "2015-05-03T17:56:09.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '33c73dfd66f9fb0e8bc30b53b150e202e7fc3055']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546613a-65b8-4b22-bbb4-4f58950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:10.000Z" ,
"modified" : "2015-05-03T17:56:10.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '350a922a008078c6fdbee9f566363f553ea55394']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546613a-f670-4fac-91f6-4a21950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:10.000Z" ,
"modified" : "2015-05-03T17:56:10.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '3916a8150fa10d4b4999f6bd97b7e7464bea13d1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546613a-2780-4cca-a850-48d2950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:10.000Z" ,
"modified" : "2015-05-03T17:56:10.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed." ,
"pattern" : "[file:hashes.SHA1 = '3cdde0489afab5c5fd9098c408c7419b44d2bc46']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546615c-f99c-4629-b4cd-4483950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:44.000Z" ,
"modified" : "2015-05-03T17:56:44.000Z" ,
"pattern" : "[file:hashes.SHA1 = '61a7cc6ed45657fa1330e922aea33254b189ef61']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546615d-96e0-45d6-9dcd-4ada950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:45.000Z" ,
"modified" : "2015-05-03T17:56:45.000Z" ,
"pattern" : "[file:hashes.SHA1 = '6f252485dee0b854f72cc8b64601f6f19d01c02c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5546615d-3608-4a5a-8cea-47b8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:56:45.000Z" ,
"modified" : "2015-05-03T17:56:45.000Z" ,
"pattern" : "[file:hashes.SHA1 = '85e10382b06801770a4477505ed5d8c75fb37135']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-05-03T17:56:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5546619a-8b20-4c44-819b-4b94950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-05-03T17:57:46.000Z" ,
"modified" : "2015-05-03T17:57:46.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"Other\""
] ,
"x_misp_category" : "Other" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "Update as of May 1, 2015, 11:00 PM (GMT+8) \r\nThe list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653eb-6c0c-46ae-bd9e-48b6950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:39.000Z" ,
"modified" : "2015-11-13T21:19:39.000Z" ,
"description" : "- Xchecked via VT: 85e10382b06801770a4477505ed5d8c75fb37135" ,
"pattern" : "[file:hashes.SHA256 = '4962bd87d1a7ef48a1eb67d1793f0f7cccbbf7aaffd58ab37e578476f80ec4d2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653eb-a23c-472c-ba92-4cfe950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:39.000Z" ,
"modified" : "2015-11-13T21:19:39.000Z" ,
"description" : "- Xchecked via VT: 85e10382b06801770a4477505ed5d8c75fb37135" ,
"pattern" : "[file:hashes.MD5 = 'a5cfe37d8ecfc22a60954f8462273e3f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653ec-e944-4759-9825-41a5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:40.000Z" ,
"modified" : "2015-11-13T21:19:40.000Z" ,
"first_observed" : "2015-11-13T21:19:40Z" ,
"last_observed" : "2015-11-13T21:19:40Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653ec-e944-4759-9825-41a5950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653ec-e944-4759-9825-41a5950d210b" ,
"value" : "https://www.virustotal.com/file/4962bd87d1a7ef48a1eb67d1793f0f7cccbbf7aaffd58ab37e578476f80ec4d2/analysis/1430810167/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ec-e414-4f2b-af71-49ac950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:40.000Z" ,
"modified" : "2015-11-13T21:19:40.000Z" ,
"description" : "- Xchecked via VT: 6f252485dee0b854f72cc8b64601f6f19d01c02c" ,
"pattern" : "[file:hashes.SHA256 = '5c85a8f0ce0e1a31fe07fd964e5c87e2394d542b8113f5d9dcfc47391dfbab95']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ed-3afc-4fc5-8a56-416a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:41.000Z" ,
"modified" : "2015-11-13T21:19:41.000Z" ,
"description" : "- Xchecked via VT: 6f252485dee0b854f72cc8b64601f6f19d01c02c" ,
"pattern" : "[file:hashes.MD5 = '91207439790ffe5f0d177c27cf4d68ac']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653ed-1c88-4a60-a1f3-4918950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:41.000Z" ,
"modified" : "2015-11-13T21:19:41.000Z" ,
"first_observed" : "2015-11-13T21:19:41Z" ,
"last_observed" : "2015-11-13T21:19:41Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653ed-1c88-4a60-a1f3-4918950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653ed-1c88-4a60-a1f3-4918950d210b" ,
"value" : "https://www.virustotal.com/file/5c85a8f0ce0e1a31fe07fd964e5c87e2394d542b8113f5d9dcfc47391dfbab95/analysis/1430418843/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ee-aa3c-49b2-96d7-4df5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:42.000Z" ,
"modified" : "2015-11-13T21:19:42.000Z" ,
"description" : "- Xchecked via VT: 61a7cc6ed45657fa1330e922aea33254b189ef61" ,
"pattern" : "[file:hashes.SHA256 = '7b3a6e7708fc7795a437fe62c954f780132fe0a41d9b679039011bc1a6cb4593']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ee-d81c-49f4-9f33-4a2e950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:42.000Z" ,
"modified" : "2015-11-13T21:19:42.000Z" ,
"description" : "- Xchecked via VT: 61a7cc6ed45657fa1330e922aea33254b189ef61" ,
"pattern" : "[file:hashes.MD5 = '05be09f648bf2b62ebf9cd79ccfd0087']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload installation"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload installation\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653ef-fc04-407f-bcf9-4343950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:43.000Z" ,
"modified" : "2015-11-13T21:19:43.000Z" ,
"first_observed" : "2015-11-13T21:19:43Z" ,
"last_observed" : "2015-11-13T21:19:43Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653ef-fc04-407f-bcf9-4343950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653ef-fc04-407f-bcf9-4343950d210b" ,
"value" : "https://www.virustotal.com/file/7b3a6e7708fc7795a437fe62c954f780132fe0a41d9b679039011bc1a6cb4593/analysis/1430810886/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ef-3464-497e-a5b6-4828950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:43.000Z" ,
"modified" : "2015-11-13T21:19:43.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 3cdde0489afab5c5fd9098c408c7419b44d2bc46" ,
"pattern" : "[file:hashes.SHA256 = '1fa6eabce6d6f3290bd57ed7e52d49079d1a2340f2901130e084da4a75de29ec']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ef-24b0-465e-aa3c-41e7950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:43.000Z" ,
"modified" : "2015-11-13T21:19:43.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 3cdde0489afab5c5fd9098c408c7419b44d2bc46" ,
"pattern" : "[file:hashes.MD5 = 'abc718998731a961f9110e5b6cc07f3b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f0-d6ac-4dd8-b0f5-42c2950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:44.000Z" ,
"modified" : "2015-11-13T21:19:44.000Z" ,
"first_observed" : "2015-11-13T21:19:44Z" ,
"last_observed" : "2015-11-13T21:19:44Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f0-d6ac-4dd8-b0f5-42c2950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f0-d6ac-4dd8-b0f5-42c2950d210b" ,
"value" : "https://www.virustotal.com/file/1fa6eabce6d6f3290bd57ed7e52d49079d1a2340f2901130e084da4a75de29ec/analysis/1430809411/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f0-6b44-455e-85a3-4cd0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:44.000Z" ,
"modified" : "2015-11-13T21:19:44.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 350a922a008078c6fdbee9f566363f553ea55394" ,
"pattern" : "[file:hashes.SHA256 = '6b048ac41c1e58773c00858e9644cb88bf2fae37af5b4b02d090f6bd310c03b4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f1-a040-41ce-8946-49e5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:45.000Z" ,
"modified" : "2015-11-13T21:19:45.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 350a922a008078c6fdbee9f566363f553ea55394" ,
"pattern" : "[file:hashes.MD5 = 'cf6ac741c96d163c9f0fbf8538facd19']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f1-e77c-439d-9622-410f950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:45.000Z" ,
"modified" : "2015-11-13T21:19:45.000Z" ,
"first_observed" : "2015-11-13T21:19:45Z" ,
"last_observed" : "2015-11-13T21:19:45Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f1-e77c-439d-9622-410f950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f1-e77c-439d-9622-410f950d210b" ,
"value" : "https://www.virustotal.com/file/6b048ac41c1e58773c00858e9644cb88bf2fae37af5b4b02d090f6bd310c03b4/analysis/1429800798/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f1-7694-4f52-aff0-4dba950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:45.000Z" ,
"modified" : "2015-11-13T21:19:45.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 33c73dfd66f9fb0e8bc30b53b150e202e7fc3055" ,
"pattern" : "[file:hashes.SHA256 = 'f0cefa8f94e2d5fe0ac01a4f012a92c111946f8d1be9fd3708d3b642ca7ad16f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f2-ab38-4009-a63d-4c07950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:46.000Z" ,
"modified" : "2015-11-13T21:19:46.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 33c73dfd66f9fb0e8bc30b53b150e202e7fc3055" ,
"pattern" : "[file:hashes.MD5 = 'b49643e6a02b73b97f3c7896194f662d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f2-d5c8-4922-bc41-4c1e950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:46.000Z" ,
"modified" : "2015-11-13T21:19:46.000Z" ,
"first_observed" : "2015-11-13T21:19:46Z" ,
"last_observed" : "2015-11-13T21:19:46Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f2-d5c8-4922-bc41-4c1e950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f2-d5c8-4922-bc41-4c1e950d210b" ,
"value" : "https://www.virustotal.com/file/f0cefa8f94e2d5fe0ac01a4f012a92c111946f8d1be9fd3708d3b642ca7ad16f/analysis/1430490974/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f2-2c58-4ef4-98f6-4a39950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:46.000Z" ,
"modified" : "2015-11-13T21:19:46.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 339543194c2e64c27d746572d235dba37a332eeb" ,
"pattern" : "[file:hashes.SHA256 = '8e1ab2fd5b7fbd74ba61dae69719a5eb11f9396030bd8f6dfe82704bf0f5ff00']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f3-d0e0-4bd0-958e-4233950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:47.000Z" ,
"modified" : "2015-11-13T21:19:47.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 339543194c2e64c27d746572d235dba37a332eeb" ,
"pattern" : "[file:hashes.MD5 = '28aaa2613173586b8b31eef7dc4fcdce']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f3-8650-4f8c-b4d1-477b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:47.000Z" ,
"modified" : "2015-11-13T21:19:47.000Z" ,
"first_observed" : "2015-11-13T21:19:47Z" ,
"last_observed" : "2015-11-13T21:19:47Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f3-8650-4f8c-b4d1-477b950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f3-8650-4f8c-b4d1-477b950d210b" ,
"value" : "https://www.virustotal.com/file/8e1ab2fd5b7fbd74ba61dae69719a5eb11f9396030bd8f6dfe82704bf0f5ff00/analysis/1430896749/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f4-29dc-43b0-9334-4839950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:48.000Z" ,
"modified" : "2015-11-13T21:19:48.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 31e2a2152a974f69e98c235c0dd3cddc1984b8da" ,
"pattern" : "[file:hashes.SHA256 = '9290501fd626add6de2a10733e2a9ebf19ca9a71bb068a2cb8717d8d6d59a0cd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f4-d934-482c-a980-4a6e950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:48.000Z" ,
"modified" : "2015-11-13T21:19:48.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 31e2a2152a974f69e98c235c0dd3cddc1984b8da" ,
"pattern" : "[file:hashes.MD5 = '386d736cdffa5812850e53494a66793a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f4-a240-4e68-adb5-4221950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:48.000Z" ,
"modified" : "2015-11-13T21:19:48.000Z" ,
"first_observed" : "2015-11-13T21:19:48Z" ,
"last_observed" : "2015-11-13T21:19:48Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f4-a240-4e68-adb5-4221950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f4-a240-4e68-adb5-4221950d210b" ,
"value" : "https://www.virustotal.com/file/9290501fd626add6de2a10733e2a9ebf19ca9a71bb068a2cb8717d8d6d59a0cd/analysis/1430753558/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f5-4fd8-4e0e-9fbd-4607950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:49.000Z" ,
"modified" : "2015-11-13T21:19:49.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 31dcc204661eee13920fda7ec582aaa1ec48f821" ,
"pattern" : "[file:hashes.SHA256 = '441e48ed561cc3322bf02f14723bc6549d08e59c00b4c443b5efbf9d374a5303']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f5-db4c-4003-a928-488b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:49.000Z" ,
"modified" : "2015-11-13T21:19:49.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 31dcc204661eee13920fda7ec582aaa1ec48f821" ,
"pattern" : "[file:hashes.MD5 = '2813ae3302a4c2892c947144ab289872']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f6-f07c-46d1-a618-4248950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:50.000Z" ,
"modified" : "2015-11-13T21:19:50.000Z" ,
"first_observed" : "2015-11-13T21:19:50Z" ,
"last_observed" : "2015-11-13T21:19:50Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f6-f07c-46d1-a618-4248950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f6-f07c-46d1-a618-4248950d210b" ,
"value" : "https://www.virustotal.com/file/441e48ed561cc3322bf02f14723bc6549d08e59c00b4c443b5efbf9d374a5303/analysis/1429789168/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f6-4b1c-403a-a2d9-4610950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:50.000Z" ,
"modified" : "2015-11-13T21:19:50.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 2b01eb798d31d91cc03221b82c3f3fe04f4eb40a" ,
"pattern" : "[file:hashes.SHA256 = 'a393243694bc7b536240da7605cb812d23879e41495efc89f032259c65dbb220']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f6-a338-4490-92bc-47e7950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:50.000Z" ,
"modified" : "2015-11-13T21:19:50.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 2b01eb798d31d91cc03221b82c3f3fe04f4eb40a" ,
"pattern" : "[file:hashes.MD5 = '593c5fea01fb19a14dbe161fe754108a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f7-298c-4c97-806b-4d9b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:51.000Z" ,
"modified" : "2015-11-13T21:19:51.000Z" ,
"first_observed" : "2015-11-13T21:19:51Z" ,
"last_observed" : "2015-11-13T21:19:51Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f7-298c-4c97-806b-4d9b950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f7-298c-4c97-806b-4d9b950d210b" ,
"value" : "https://www.virustotal.com/file/a393243694bc7b536240da7605cb812d23879e41495efc89f032259c65dbb220/analysis/1430753559/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f7-1ea8-4c79-af8f-4331950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:51.000Z" ,
"modified" : "2015-11-13T21:19:51.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 29e4f4013c07dfcb0aae20c806b157ed7f023e9c" ,
"pattern" : "[file:hashes.SHA256 = 'a1c02381fa46138aaa84c2cf19b6a2d26b815cc31f73b84a207fa419474a0bbb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f8-e2bc-440c-a599-45db950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:52.000Z" ,
"modified" : "2015-11-13T21:19:52.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 29e4f4013c07dfcb0aae20c806b157ed7f023e9c" ,
"pattern" : "[file:hashes.MD5 = '86e58db678dc48aa869c8f8fd5592055']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f8-ef50-488d-bc19-4be1950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:52.000Z" ,
"modified" : "2015-11-13T21:19:52.000Z" ,
"first_observed" : "2015-11-13T21:19:52Z" ,
"last_observed" : "2015-11-13T21:19:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f8-ef50-488d-bc19-4be1950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f8-ef50-488d-bc19-4be1950d210b" ,
"value" : "https://www.virustotal.com/file/a1c02381fa46138aaa84c2cf19b6a2d26b815cc31f73b84a207fa419474a0bbb/analysis/1430809349/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f8-5f9c-453e-a967-4dba950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:52.000Z" ,
"modified" : "2015-11-13T21:19:52.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 25cbbcc94782b2f1efd46179f28c517af44637fb" ,
"pattern" : "[file:hashes.SHA256 = 'ff352e51858dcab7ef9a69f15a8dd3b7d262d174d819c649f774ab0705703585']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653f9-ba60-4773-a625-48e7950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:53.000Z" ,
"modified" : "2015-11-13T21:19:53.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 25cbbcc94782b2f1efd46179f28c517af44637fb" ,
"pattern" : "[file:hashes.MD5 = 'e132ac28cc6163c1004ae0c84b908849']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653f9-66c0-4633-b4b5-4bec950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:53.000Z" ,
"modified" : "2015-11-13T21:19:53.000Z" ,
"first_observed" : "2015-11-13T21:19:53Z" ,
"last_observed" : "2015-11-13T21:19:53Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653f9-66c0-4633-b4b5-4bec950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653f9-66c0-4633-b4b5-4bec950d210b" ,
"value" : "https://www.virustotal.com/file/ff352e51858dcab7ef9a69f15a8dd3b7d262d174d819c649f774ab0705703585/analysis/1429801974/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fa-3c30-4d50-bdfd-449b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:54.000Z" ,
"modified" : "2015-11-13T21:19:54.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 23f9777f17f86c9c8cbf25672e2e783ab0acc58c" ,
"pattern" : "[file:hashes.SHA256 = '7c63e1d82468998677b314a071264b0f6ca67c6b4a22f6fa6c22c468a594bd2a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fa-dbbc-4c0f-bf03-4c8e950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:54.000Z" ,
"modified" : "2015-11-13T21:19:54.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 23f9777f17f86c9c8cbf25672e2e783ab0acc58c" ,
"pattern" : "[file:hashes.MD5 = '47a2eabeed5e3edd8382f9a52d99a3cc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653fa-56d8-4689-a5d3-465d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:54.000Z" ,
"modified" : "2015-11-13T21:19:54.000Z" ,
"first_observed" : "2015-11-13T21:19:54Z" ,
"last_observed" : "2015-11-13T21:19:54Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653fa-56d8-4689-a5d3-465d950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653fa-56d8-4689-a5d3-465d950d210b" ,
"value" : "https://www.virustotal.com/file/7c63e1d82468998677b314a071264b0f6ca67c6b4a22f6fa6c22c468a594bd2a/analysis/1430809477/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fb-7dd8-451e-a86f-49e3950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:55.000Z" ,
"modified" : "2015-11-13T21:19:55.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 18df8417fce6f9e24c8369a2897eaf29b1ec11c4" ,
"pattern" : "[file:hashes.SHA256 = '8a7534b23f0133de3027f0bb0aa04b3b8ea61af275f2128a9dead90f3264ab5d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fb-e2f8-4fc2-9393-4435950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:55.000Z" ,
"modified" : "2015-11-13T21:19:55.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 18df8417fce6f9e24c8369a2897eaf29b1ec11c4" ,
"pattern" : "[file:hashes.MD5 = 'b504965c00c94aa93d093fb72035d200']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653fc-f88c-474c-8131-47e8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:56.000Z" ,
"modified" : "2015-11-13T21:19:56.000Z" ,
"first_observed" : "2015-11-13T21:19:56Z" ,
"last_observed" : "2015-11-13T21:19:56Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653fc-f88c-474c-8131-47e8950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653fc-f88c-474c-8131-47e8950d210b" ,
"value" : "https://www.virustotal.com/file/8a7534b23f0133de3027f0bb0aa04b3b8ea61af275f2128a9dead90f3264ab5d/analysis/1430810981/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fc-b6ac-4956-adf3-4087950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:56.000Z" ,
"modified" : "2015-11-13T21:19:56.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 1363b79fc25467ea01842c5cbfa90c90bd7e7790" ,
"pattern" : "[file:hashes.SHA256 = 'e024d802b7fc976ed43a863f697658cb4aeacdcb905c1a7df951355b086d41e2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fc-6b28-4e08-a03d-4df4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:56.000Z" ,
"modified" : "2015-11-13T21:19:56.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 1363b79fc25467ea01842c5cbfa90c90bd7e7790" ,
"pattern" : "[file:hashes.MD5 = '78eb5aaf0b7b133af9666dc8e99909fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653fd-4b88-427b-a592-4a9d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:57.000Z" ,
"modified" : "2015-11-13T21:19:57.000Z" ,
"first_observed" : "2015-11-13T21:19:57Z" ,
"last_observed" : "2015-11-13T21:19:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653fd-4b88-427b-a592-4a9d950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653fd-4b88-427b-a592-4a9d950d210b" ,
"value" : "https://www.virustotal.com/file/e024d802b7fc976ed43a863f697658cb4aeacdcb905c1a7df951355b086d41e2/analysis/1430753556/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fd-d208-4dc4-bbb5-4c0f950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:57.000Z" ,
"modified" : "2015-11-13T21:19:57.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 0fad05ba34d91de15047052c4a6166d92aa5e3ac" ,
"pattern" : "[file:hashes.SHA256 = 'f695413819c0e10de4d016bda25741759b997269784cbc37ceb45de1c84c39d6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fe-1c5c-43a8-812d-41ae950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:58.000Z" ,
"modified" : "2015-11-13T21:19:58.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 0fad05ba34d91de15047052c4a6166d92aa5e3ac" ,
"pattern" : "[file:hashes.MD5 = 'b8d31cfd80a4c0b4db7eba82710f30ea']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653fe-1cb4-4208-abe1-4e7d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:58.000Z" ,
"modified" : "2015-11-13T21:19:58.000Z" ,
"first_observed" : "2015-11-13T21:19:58Z" ,
"last_observed" : "2015-11-13T21:19:58Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653fe-1cb4-4208-abe1-4e7d950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653fe-1cb4-4208-abe1-4e7d950d210b" ,
"value" : "https://www.virustotal.com/file/f695413819c0e10de4d016bda25741759b997269784cbc37ceb45de1c84c39d6/analysis/1430753555/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653fe-1a18-48c1-a0e2-45de950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:58.000Z" ,
"modified" : "2015-11-13T21:19:58.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 0b4100e124507a174f147c3bf0121769ab209104" ,
"pattern" : "[file:hashes.SHA256 = 'c34c76f2f74dfa2fb1b588fd9940ace900da6e1aa411b1a4af51e151a809d8c7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--564653ff-5ebc-4304-b1db-4ba3950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:59.000Z" ,
"modified" : "2015-11-13T21:19:59.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 0b4100e124507a174f147c3bf0121769ab209104" ,
"pattern" : "[file:hashes.MD5 = '694ef544a592a13ba701b73b7613cda6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:19:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--564653ff-8738-42bd-9f6a-4763950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:19:59.000Z" ,
"modified" : "2015-11-13T21:19:59.000Z" ,
"first_observed" : "2015-11-13T21:19:59Z" ,
"last_observed" : "2015-11-13T21:19:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--564653ff-8738-42bd-9f6a-4763950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--564653ff-8738-42bd-9f6a-4763950d210b" ,
"value" : "https://www.virustotal.com/file/c34c76f2f74dfa2fb1b588fd9940ace900da6e1aa411b1a4af51e151a809d8c7/analysis/1430810856/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--56465400-6bf8-4ad5-9239-4ea3950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:00.000Z" ,
"modified" : "2015-11-13T21:20:00.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 037cebf49a412bcabd7d3b896382af53eaecabed" ,
"pattern" : "[file:hashes.SHA256 = 'ef9643c0986331477b6eff730b299b9a4b844b38a52ee36d2b672b03e31f3c4a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:20:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--56465400-44d0-4f4c-a739-4fc7950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:00.000Z" ,
"modified" : "2015-11-13T21:20:00.000Z" ,
"description" : "Update as of May 1, 2015, 11:00 PM (GMT+8) The list above has been modified to indicate the hashes of the malicious Microsoft Office documents instead of HTML files as previously listed. - Xchecked via VT: 037cebf49a412bcabd7d3b896382af53eaecabed" ,
"pattern" : "[file:hashes.MD5 = 'c5ad2537409683eaa71c36c66ab2f05e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:20:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--56465400-6c14-4580-9f6a-4445950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:00.000Z" ,
"modified" : "2015-11-13T21:20:00.000Z" ,
"first_observed" : "2015-11-13T21:20:00Z" ,
"last_observed" : "2015-11-13T21:20:00Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--56465400-6c14-4580-9f6a-4445950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--56465400-6c14-4580-9f6a-4445950d210b" ,
"value" : "https://www.virustotal.com/file/ef9643c0986331477b6eff730b299b9a4b844b38a52ee36d2b672b03e31f3c4a/analysis/1439140579/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--56465401-6a40-413e-b65e-4df0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:01.000Z" ,
"modified" : "2015-11-13T21:20:01.000Z" ,
"description" : "TSPY_DYRE.YUYCC - Xchecked via VT: 5e392950fa295a98219e1fc9cce7a7048792845e" ,
"pattern" : "[file:hashes.SHA256 = 'ec05df2a8f7a7bc2ae5b3c153c9ec450e3611b2343572d0aa8d84a8b1d23ee8d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:20:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--56465401-cc6c-4e48-833a-44b0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:01.000Z" ,
"modified" : "2015-11-13T21:20:01.000Z" ,
"description" : "TSPY_DYRE.YUYCC - Xchecked via VT: 5e392950fa295a98219e1fc9cce7a7048792845e" ,
"pattern" : "[file:hashes.MD5 = '22a7aafe5190a5cdcc92bfd304a21f7d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-11-13T21:20:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--56465402-e55c-4de8-b766-47da950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-11-13T21:20:02.000Z" ,
"modified" : "2015-11-13T21:20:02.000Z" ,
"first_observed" : "2015-11-13T21:20:02Z" ,
"last_observed" : "2015-11-13T21:20:02Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--56465402-e55c-4de8-b766-47da950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--56465402-e55c-4de8-b766-47da950d210b" ,
"value" : "https://www.virustotal.com/file/ec05df2a8f7a7bc2ae5b3c153c9ec450e3611b2343572d0aa8d84a8b1d23ee8d/analysis/1446494503/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
